> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Stephane Lentz > Sent: Friday, October 31, 2003 7:10 PM > To: [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED] > Subject: Re: [SAtalk] New virus W32.MIMAIL.C > > On Fri, Oct 31, 2003 at 12:10:23PM -0500, > [EMAIL PROTECTED] wrote: > > Here's some info > > http://www.sarc.com/avcenter/venc/data/[EMAIL PROTECTED] > > > > I'm using the following in local.cf to score these messages > high enough > > to be rejected. > > > > header W32_MIMAIL_C Subject =~ /our private photos/ > > describe W32_MIMAIL_C Keep your viruses. > > score W32_MIMAIL_C 150 > > > > Does anyone have anything better? > > > The infected messages also have the following headers > characteristics : > X-Mailer: The Bat! (v1.62) > X-Priority: 1 (High) > > SL/ > --- > Stephane Lentz > Alcanet International, Internet Services > You could always add the "Re[2]: " in front, that should pretty well take care of any FPs.
header W32_MIMAIL_C Subject =~ /Re\[2\]\: our private photos/ (don't remember if the : needs to have the \ in front or not) I've had over 150 quarantined today and they all seem to have the same subject line, well except for the random text at the end. Didn't even have to put anything special in :) X-Spam-Status: Yes, hits=11.9 tag1=0.0 tag2=6.0 kill=10.0 tests=BAYES_60, FORGED_MUA_THEBAT, NO_REAL_NAME, SUBJ_HAS_SPACES, X_PRIORITY_HIGH Go SA go! -matt ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
